den4uk / andriller Goto Github PK

Mobile: honor 9 - broken screen (can see something, but cannot use touchscreen at all)

When I connected it to my pc it is detected as a mobile connected through USB, but of course I cant open it in file manager due to impossibility to allow file sharing from the broken screen.

In home GUI of andriller I select CHECK and it turns: Device not detected!

How can I extract my file from my broken phone?

Thanks in advance

-dennix91

the backup is not working with an error "Andriod backup failed - too small
i have this issue on my old Sony Andriod and HTC phone. they connect but it never worked.

any ideas?

Where and how will I find the key file for decrypting my whatsapp databases? In the manual its written that the file will be stored in /data/data/com.whatsapp but there is no such directory in the Extracted folder.

How to crack the pin, where will i find the Salt and Password hash, I have downloaded version 3.3.1 from the website and Get Salt From..... option isn’t showing up in the Lockscreen Section.

Ιt seems that the specific mode is not supported by the most recent Python libraries (tried with Ubuntu 18.04 - Python v. 3.6.9). If 'MODE_CBC', 'MODE_CFB', 'MODE_CTR', 'MODE_ECB', 'MODE_OFB', 'MODE_OPENPGP', 'MODE_PGP' are used alternatively, Andriller runs, but I am not aware of the decrypting efficiency yet.

Hey is there anyway to have Andriller use a different folder then /tmp it seems to be running out of space since /tmp is using ram not hdd space here is the error i get after the backup is taken and the extraction starts.

INFO:andriller.gui.core:Reading information...
INFO:andriller.gui.core:Acquiring data...
INFO:andriller.gui.core:Extracting data from source...
INFO:andriller.gui.core:Unpacking backup...
Exception in thread Thread-6:
Traceback (most recent call last):
  File "/usr/lib/python3.9/threading.py", line 973, in _bootstrap_inner
    self.run()
  File "/usr/lib/python3.9/threading.py", line 910, in run
    self._target(*self._args, **self._kwargs)
  File "/home/*****/builds/andriller/andriller/utils.py", line 40, in command
    return method(self, *args, **kwargs)
  File "/home/******/builds/andriller/andriller/gui/windows.py", line 418, in RunUsbExtraction
    drill.DataExtraction()
  File "/home/*******/builds/andriller/andriller/driller.py", line 316, in DataExtraction
    self.AndroidBackupToTar()
  File "/home/******/builds/andriller/andriller/driller.py", line 253, in AndroidBackupToTar
    self.tarfile = self.tools.ab_to_tar(self.backup)
  File "/home/********/builds/andriller/andriller/utils.py", line 163, in ab_to_tar
    temptar.write(c)
  File "/usr/lib/python3.9/tempfile.py", line 474, in func_wrapper
    return func(*args, **kwargs)
OSError: [Errno 28] No space left on device

Any help is greatly appreciated.

Thanks

i had configured it in every way it could be, with different python and pip versions, with and without different virtuell environments but the Issue seems every Time to be the same. Please anybody help me, I want to understand what's the problem, was it am i or some in the Code Base. Here the Error Code.

File "/usr/local/Cellar/[email protected]/3.10.2/Frameworks/Python.framework/Versions/3.10/lib/python3.10/runpy.py", line 196, in _run_module_as_main
return _run_code(code, main_globals, None,
File "/usr/local/Cellar/[email protected]/3.10.2/Frameworks/Python.framework/Versions/3.10/lib/python3.10/runpy.py", line 86, in _run_code
exec(code, run_globals)
File "/Users/0x01/Tools/MOBILE/andriller/andriller/main.py", line 1, in
from . import run
ImportError: attempted relative import with no known parent package

Thank every who can respond some infos to that Post.

Greetz

Im Mac User.. I already open Terminal.. Next What I have to do...

It would appear that line 162 causes me a serious headache when trying to convert an android.ab file into a .tar and when I try to perform the initial extraction with adb via Andriller. If it helps, the device in question is running Android 11 and the device is a Samsung S10 galaxy. I've looked on a couple forums now, that suggest modifying the zlib decompression syntax, but nothing seems to be working in my favor.

Any help would be greatly appreciated!

Thank you!

Describe the bug
Older FaceBook Messenger file will not parse

To Reproduce
Steps to reproduce the behavior:

1. Go to Decoders
2. Scroll down to Facebook Messenger
3. Select db file
4. See error below

Expected behavior
Parse the messages

Screenshots
Started: Andriller CE 3.5.3
Time settings/format: Y-m-d H:M:S Z
Detected/PC time: 2021-09-24 11:38:49
Universal time: 2021-09-24 15:38:49 UTC
Time in reports: 2021-09-24 15:38:49 UTC <--
Decoding: threads_db2
'sticker_id'
Traceback (most recent call last):
File "andriller\windows.py", line 63, in func
File "andriller\windows.py", line 509, in decode_file
File "andriller\decoders.py", line 531, in init
File "andriller\classes.py", line 68, in init
File "andriller\decoders.py", line 619, in main
File "andriller\decoders.py", line 575, in get_sticker
KeyError: 'sticker_id'

Environment (please complete the following information):

• OS: Windows 11
• Andriller version 3.5.3
• Was it an installer or run from source (installer/source). CE Version

Target Android device (where applicable):
Extracted file

Error Log / Traceback
Started: Andriller CE 3.5.3
Time settings/format: Y-m-d H:M:S Z
Detected/PC time: 2021-09-24 11:38:49
Universal time: 2021-09-24 15:38:49 UTC
Time in reports: 2021-09-24 15:38:49 UTC <--
Decoding: threads_db2
'sticker_id'
Traceback (most recent call last):
File "andriller\windows.py", line 63, in func
File "andriller\windows.py", line 509, in decode_file
File "andriller\decoders.py", line 531, in init
File "andriller\classes.py", line 68, in init
File "andriller\decoders.py", line 619, in main
File "andriller\decoders.py", line 575, in get_sticker
KeyError: 'sticker_id'

Additional context
None

$ pytest-3 tests
/usr/lib/python3.7/site-packages/trio/_core/_multierror.py:450: RuntimeWarning: You seem to already have a custom sys.excepthook handler installed. I'll skip installing trio's custom handler, but this means MultiErrors will not show full tracebacks.
  category=RuntimeWarning
Test session starts (platform: linux, Python 3.7.6, pytest 4.6.9, pytest-sugar 0.9.2)
hypothesis profile 'default' -> database=DirectoryBasedExampleDatabase('/home/fab/Documents/repos/andriller/.hypothesis/examples')
rootdir: /home/fab/Documents/repos/andriller
plugins: hypothesis-4.23.8, requests-mock-1.7.0, case-1.5.3, sugar-0.9.2, betamax-0.8.1, asyncio-0.10.0, toolbox-0.4, timeout-1.3.3, cov-2.8.1, isort-0.3.1, forked-1.0.2, aspectlib-1.4.2, mock-1.10.4, trio-0.5.2, flaky-3.5.3, django-3.7.0
collecting ... 
―――――――――――――――――――――――――――――――――――――――――――――――――― tests/test_registry.py ―――――――――――――――――――――――――――――――――――――――――――――――――――
tests/test_registry.py:2: in <module>
    from andriller import decoders
andriller/decoders.py:12: in <module>
    javaobj._log.level = logging.WARNING
E   AttributeError: module 'javaobj' has no attribute '_log'

===Flaky Test Report===


===End Flaky Test Report===
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Interrupted: 1 errors during collection !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Results (0.31s):

$ pip3 freeze | grep java
javaobj-py3==0.2.4

Same issue is present during the RPM build process for Fedora but with javaobj-0.4.0.1.

Describe the bug
Extraction errors present in console.

To Reproduce
Run the extraction process and have the below applications installed on the device.

com.coffeebeanventures.easyvoicerecorder
com.enflick.android.tn2ndLine
com.google.ar.core
com.first75.voicerecorder2

Expected behavior
No extraction errors.

Environment (please complete the following information):

• OS: [Windows 11]
• Andriller version [3.6.3]
• Was it an installer or run from source [source]. If from source, answer next questions.
• Python version [3.10.10]
• ADB [Android Debug Bridge version 1.0.41, Version 34.0.0-9570255]

Target Android device (where applicable):

• When a device is connected, is it recognised when clicked on Check? [Yes]
• Device make / model: [Google Pixel 1 XL]
• Android OS: [10]
• Screenlock present? [Yes, known credentials]

Error Log / Traceback

INFO:andriller.gui.core:Extracting from backup...
WARNING:andriller.utils:Failed extracting: apps/com.coffeebeanventures.easyvoicerecorder/f/frc_1:825736981540:android:be9a11b36738e6c1_firebase_activate.json > [Errno 22] Invalid argument: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.coffeebeanventures.easyvoicerecorder\\f\\frc_1:825736981540:android:be9a11b36738e6c1_firebase_activate.json'
WARNING:andriller.utils:Failed extracting: apps/com.coffeebeanventures.easyvoicerecorder/f/frc_1:825736981540:android:be9a11b36738e6c1_firebase_defaults.json > [Errno 22] Invalid argument: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.coffeebeanventures.easyvoicerecorder\\f\\frc_1:825736981540:android:be9a11b36738e6c1_firebase_defaults.json'
WARNING:andriller.utils:Failed extracting: apps/com.enflick.android.tn2ndLine/f/frc_1:302791216486:android:f6a91e8a5cadf642_fireperf_activate.json > [Errno 22] Invalid argument: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.enflick.android.tn2ndLine\\f\\frc_1:302791216486:android:f6a91e8a5cadf642_fireperf_activate.json'
WARNING:andriller.utils:Failed extracting: apps/com.enflick.android.tn2ndLine/f/frc_1:302791216486:android:f6a91e8a5cadf642_firebase_activate.json > [Errno 22] Invalid argument: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.enflick.android.tn2ndLine\\f\\frc_1:302791216486:android:f6a91e8a5cadf642_firebase_activate.json'
WARNING:andriller.utils:Failed extracting: apps/com.enflick.android.tn2ndLine/f/frc_1:302791216486:android:f6a91e8a5cadf642_firebase_defaults.json > [Errno 22] Invalid argument: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.enflick.android.tn2ndLine\\f\\frc_1:302791216486:android:f6a91e8a5cadf642_firebase_defaults.json'
WARNING:andriller.utils:Failed extracting: apps/com.enflick.android.tn2ndLine/f/.Fabric/io.fabric.sdk.android:fabric > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.enflick.android.tn2ndLine\\f\\.Fabric\\io.fabric.sdk.android:fabric'
WARNING:andriller.utils:Failed extracting: apps/com.enflick.android.tn2ndLine/f/.Fabric/io.fabric.sdk.android:fabric/com.crashlytics.settings.json > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.enflick.android.tn2ndLine\\f\\.Fabric\\io.fabric.sdk.android:fabric'
WARNING:andriller.utils:Failed extracting: apps/com.enflick.android.tn2ndLine/f/.Fabric/com.crashlytics.sdk.android:answers > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.enflick.android.tn2ndLine\\f\\.Fabric\\com.crashlytics.sdk.android:answers'
WARNING:andriller.utils:Failed extracting: apps/com.enflick.android.tn2ndLine/f/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.enflick.android.tn2ndLine\\f\\.Fabric\\com.crashlytics.sdk.android:answers'
WARNING:andriller.utils:Failed extracting: apps/com.enflick.android.tn2ndLine/f/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.enflick.android.tn2ndLine\\f\\.Fabric\\com.crashlytics.sdk.android:answers'
WARNING:andriller.utils:Failed extracting: apps/com.enflick.android.tn2ndLine/f/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_72007efe-3b97-4bdb-90e1-0b28d7e88306_1588186234634.tap > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.enflick.android.tn2ndLine\\f\\.Fabric\\com.crashlytics.sdk.android:answers'
WARNING:andriller.utils:Failed extracting: apps/com.enflick.android.tn2ndLine/sp/frc_1:302791216486:android:f6a91e8a5cadf642_fireperf_settings.xml > [Errno 22] Invalid argument: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.enflick.android.tn2ndLine\\sp\\frc_1:302791216486:android:f6a91e8a5cadf642_fireperf_settings.xml'
WARNING:andriller.utils:Failed extracting: apps/com.enflick.android.tn2ndLine/sp/io.fabric.sdk.android:fabric:io.fabric.sdk.android.Onboarding.xml > [Errno 22] Invalid argument: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.enflick.android.tn2ndLine\\sp\\io.fabric.sdk.android:fabric:io.fabric.sdk.android.Onboarding.xml'
WARNING:andriller.utils:Failed extracting: apps/com.enflick.android.tn2ndLine/sp/frc_1:302791216486:android:f6a91e8a5cadf642_firebase_settings.xml > [Errno 22] Invalid argument: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.enflick.android.tn2ndLine\\sp\\frc_1:302791216486:android:f6a91e8a5cadf642_firebase_settings.xml'
WARNING:andriller.utils:Failed extracting: apps/com.enflick.android.tn2ndLine/sp/com.crashlytics.sdk.android:answers:settings.xml > [Errno 22] Invalid argument: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.enflick.android.tn2ndLine\\sp\\com.crashlytics.sdk.android:answers:settings.xml'
WARNING:andriller.utils:Failed extracting: apps/com.first75.voicerecorder2/f/.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2 > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.first75.voicerecorder2\\f\\.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2'
WARNING:andriller.utils:Failed extracting: apps/com.first75.voicerecorder2/f/.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2/com.crashlytics.settings.json > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.first75.voicerecorder2\\f\\.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2'
WARNING:andriller.utils:Failed extracting: apps/com.first75.voicerecorder2/f/.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2/native-reports > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.first75.voicerecorder2\\f\\.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2'
WARNING:andriller.utils:Failed extracting: apps/com.first75.voicerecorder2/f/.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2/priority-reports > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.first75.voicerecorder2\\f\\.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2'
WARNING:andriller.utils:Failed extracting: apps/com.first75.voicerecorder2/f/.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2/reports > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.first75.voicerecorder2\\f\\.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2'
WARNING:andriller.utils:Failed extracting: apps/com.first75.voicerecorder2/f/.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2/open-sessions > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.first75.voicerecorder2\\f\\.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2'
WARNING:andriller.utils:Failed extracting: apps/com.first75.voicerecorder2/f/.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2/open-sessions/64095A23002500015835497EF036AC72 > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.first75.voicerecorder2\\f\\.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2'
WARNING:andriller.utils:Failed extracting: apps/com.first75.voicerecorder2/f/.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2/open-sessions/64095A23002500015835497EF036AC72/userlog > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.first75.voicerecorder2\\f\\.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2'
WARNING:andriller.utils:Failed extracting: apps/com.first75.voicerecorder2/f/.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2/open-sessions/64095A23002500015835497EF036AC72/start-time > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.first75.voicerecorder2\\f\\.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2'
WARNING:andriller.utils:Failed extracting: apps/com.first75.voicerecorder2/f/.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2/open-sessions/64095A23002500015835497EF036AC72/report > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.first75.voicerecorder2\\f\\.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2'
WARNING:andriller.utils:Failed extracting: apps/com.first75.voicerecorder2/f/.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2/open-sessions/64095A23002500015835497EF036AC72/native > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.first75.voicerecorder2\\f\\.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2'
WARNING:andriller.utils:Failed extracting: apps/com.first75.voicerecorder2/f/.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2/open-sessions/64095A23002500015835497EF036AC72/native/device.json > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.first75.voicerecorder2\\f\\.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2'
WARNING:andriller.utils:Failed extracting: apps/com.first75.voicerecorder2/f/.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2/open-sessions/64095A23002500015835497EF036AC72/native/os.json > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.first75.voicerecorder2\\f\\.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2'
WARNING:andriller.utils:Failed extracting: apps/com.first75.voicerecorder2/f/.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2/open-sessions/64095A23002500015835497EF036AC72/native/app.json > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.first75.voicerecorder2\\f\\.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2'
WARNING:andriller.utils:Failed extracting: apps/com.first75.voicerecorder2/f/.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2/open-sessions/64095A23002500015835497EF036AC72/native/session.json > [WinError 267] The directory name is invalid: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.first75.voicerecorder2\\f\\.com.google.firebase.crashlytics.files.v2:com.first75.voicerecorder2'
WARNING:andriller.utils:Failed extracting: apps/com.first75.voicerecorder2/f/frc_1:143831013583:android:a60c361c36cd2a28_firebase_activate.json > [Errno 22] Invalid argument: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.first75.voicerecorder2\\f\\frc_1:143831013583:android:a60c361c36cd2a28_firebase_activate.json'
WARNING:andriller.utils:Failed extracting: apps/com.first75.voicerecorder2/f/frc_1:143831013583:android:a60c361c36cd2a28_firebase_defaults.json > [Errno 22] Invalid argument: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.first75.voicerecorder2\\f\\frc_1:143831013583:android:a60c361c36cd2a28_firebase_defaults.json'
WARNING:andriller.utils:Failed extracting: apps/com.first75.voicerecorder2/sp/frc_1:143831013583:android:a60c361c36cd2a28_firebase_settings.xml > [Errno 22] Invalid argument: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.first75.voicerecorder2\\sp\\frc_1:143831013583:android:a60c361c36cd2a28_firebase_settings.xml'
WARNING:andriller.utils:Failed extracting: apps/com.google.ar.core/sp/xcn:libraries:shared:BootCount.xml > [Errno 22] Invalid argument: 'C:\\Users\\Admin\\Downloads\\andriller-3.6.3\\backup\\HT76E0201201_shell_2023-03-09_00.48.50\\data\\apps\\com.google.ar.core\\sp\\xcn:libraries:shared:BootCount.xml'
INFO:andriller.gui.core:Decoding shared filesystem...

Running Kali Linux on XPS 13 on an external HDD

──(kali㉿kali)-[~/andriller]
└─$ python3 andriller-gui.py
Traceback (most recent call last):
File "/home/kali/andriller/andriller-gui.py", line 7, in
andriller.run()
File "/home/kali/andriller/andriller/init.py", line 60, in run
from .gui import windows
File "/home/kali/andriller/andriller/gui/windows.py", line 12, in
from .. import driller
File "/home/kali/andriller/andriller/driller.py", line 15, in
from . import decoders
File "/home/kali/andriller/andriller/decoders.py", line 3, in
import javaobj
File "/home/kali/.local/lib/python3.11/site-packages/javaobj.py", line 171
except Exception, e:
^^^^^^^^^^^^
SyntaxError: multiple exception types must be parenthesized

I followed the installation instructions for MAC/Terminal. Installed python, python-tk package, android-platform-tools, all without issue. Created the venv and activated it. Installed andriller via pip within the venv. However, when initializing Andriller inside a venv:
python -m andriller

I get a "_tkinter.python-38-darwin.so plug-in" error along with a 'OS must be 11 or later' error (attached).

Environment (please complete the following information):

• OS: MAC 11.1
• Andriller version 3.53
• Installed dependencies through homebrew
• Python version 3.9

Any help is greatly appreciated.

On phones encrypted with File Based Encryption there are two mmssms.db files. One is located in a de(device encrypted) part of the phone and used to store messages sent and received while the phone isn't decrypted, such as immediately after startup. On most phones, it's empty.

When Andriller searches for a file named mmssms.db, it doesn't know there might be two files. For me, it consistently finds the de one and never processes the ce file which contains the majority of text messages the user had sent. The only trace can be seen in the terminal, as the output in the application doesn't mention the exceptions.

INFO:andriller.windows:Decoding mmssms.db using SMSMMSDecoder
ERROR:andriller.driller:Decoding error for `mmssms.db`: Sheetname 'SMS Messages', with case ignored, is already in use.
ERROR:andriller.driller:Sheetname 'SMS Messages', with case ignored, is already in use.
Traceback (most recent call last):
  File "/home/pshem/z/source/andriller/andriller/driller.py", line 349, in DataDecoding
    deco.report_xlsx(workbook=workbook)
  File "/home/pshem/z/source/andriller/andriller/classes.py", line 222, in report_xlsx
    sheet = workbook.add_sheet(self.title)
  File "/home/pshem/z/source/andriller/andriller/engines.py", line 39, in add_sheet
    return self.workbook.add_worksheet(sheet)
  File "/home/pshem/z/source/andriller/env/lib/python3.7/site-packages/xlsxwriter/workbook.py", line 179, in add_worksheet
    return self._add_sheet(name, worksheet_class=worksheet_class)
  File "/home/pshem/z/source/andriller/env/lib/python3.7/site-packages/xlsxwriter/workbook.py", line 728, in _add_sheet
    name = self._check_sheetname(name, isinstance(worksheet, Chartsheet))
  File "/home/pshem/z/source/andriller/env/lib/python3.7/site-packages/xlsxwriter/workbook.py", line 804, in _check_sheetname
    sheetname)
xlsxwriter.exceptions.DuplicateWorksheetName: Sheetname 'SMS Messages', with case ignored, is already in use.

The de database is located in /data/user_de/0/com.android.providers.telephony/databases/(the number 0 is for the first user. The number will be different for each user on the device).
The ce database is located in /data/data/com.android.providers.telephony/databases/.

Ideally, information from both databases would have to be extracted and combined. As FBE is an option since Android 7 and mandatory since Android 10, all new devices are affected. Other decoders may also be affected, as the list of package directories in /data/user_de matches the list of pacjages in /data/data. However for me Andriller didn't loose the whatsapp messages (presumably because it's de directory only contained the cache and code_cache directories).

Describe the bug
Andriller fails to extract internal databases using the the get_file(su/cat) method.

To Reproduce

1. Connect rooted Android device.
2. Set output folder.
3. Click Check and then Extract.

Expected behavior
Andriller extracts and parses the various databases, e.g. calllog.db.

Screenshots
n/a

Environment:

• OS: Debian Sid
• Andriller version: 3.5.3
• Installation from PyPi.
• Python version: 3.9.2
• ADB binary path: /usr/bin/adb
• ADB version: Android Debug Bridge version 1.0.41, Version 28.0.2-debian, Installed as /usr/lib/android-sdk/platform-tools/adb

Target Android device:

• When a device is connected, is it recognised when clicked on Check? Yes.
• Device make / model: Oneplus 5T
• Android OS: 11 / Lineage 18.1 "dumpling"
• Screenlock present? Yes, known credentials.

Error Log / Traceback
andriller.log

Additional context
The reason appears to be related to the unstrip function in the adb_conn.py file.
With the following change which effectively bypasses the function, I got the extraction working:

136     def unstrip(self, data: bytes) -> bytes:¬                                   
137         return data # re.sub(self.rmr, b'\n', data)¬ 

So maybe the value of the _is_adb_out_post_v5 variable is not setup correctly? It appears to be False in my case, although I have adb exec-out id available.

Signal has been growing as a secure messaging platform, but extracting from it is currently not supported in Andriller. I was wondering is there is any chance for adding support either for Signal Backup or Signal Database extraction?

Their encryption code and there are standalone backup extraction utilities such as https://github.com/xeals/signal-back (written in Go) and https://github.com/tbvdm/sigbak (written in C).

Hello,
when I click on "EXTRACT", a popup telling me to save the backup on the device appears.

I look at the device, but being it encrypted by the owner, it asks to choose and insert a password for the backup.

I insert 123 just to proceed, but then Andriller gets stuck and I can see on the console

Exception in thread Thread-11: Traceback (most recent call last): File "C:\Users\Tanner\AppData\Local\Programs\Python\Python39\lib\threading.py", line 980, in _bootstrap_inner self.run() File "C:\Users\Tanner\AppData\Local\Programs\Python\Python39\lib\threading.py", line 917, in run self._target(*self._args, **self._kwargs) File "C:\Users\Tanner\AppData\Local\Programs\Python\Python39\lib\site-packages\andriller\utils.py", line 40, in command return method(self, *args, **kwargs) File "C:\Users\Tanner\AppData\Local\Programs\Python\Python39\lib\site-packages\andriller\gui\windows.py", line 418, in RunUsbExtraction drill.DataExtraction() File "C:\Users\Tanner\AppData\Local\Programs\Python\Python39\lib\site-packages\andriller\driller.py", line 316, in DataExtraction self.AndroidBackupToTar() File "C:\Users\Tanner\AppData\Local\Programs\Python\Python39\lib\site-packages\andriller\driller.py", line 253, in AndroidBackupToTar self.tarfile = self.tools.ab_to_tar(self.backup) File "C:\Users\Tanner\AppData\Local\Programs\Python\Python39\lib\site-packages\andriller\utils.py", line 160, in ab_to_tar c = zlib_obj.decompress(d) zlib.error: Error -3 while decompressing data: incorrect header check

Is there any possibility to fix this issue?

I'm not sure whether this calls for a dedicated decoded like Samsung has, but in a phone running Android 9, the calls table is now in a separate database. The phone is a Nokia 2.2 and it's part of the Android One program, so it should be basically mainline Android. The error below is caused by Andriller looking for the calls table in the contacts2.db sqlite database, while calls appear to have been moved to a separate calllog.db database located in the same directory. I'd be happy to write a patch for this if you think it's in scope.

/data/data/com.android.providers.contacts/databases contents:

pshem@computer: data/data/com.android.providers.contacts/databases$ ls
calllog.db  contacts2.db  profile.db  profile.db-journal

Tables in callog.db: anrdoid_metadata, calls, conference_calls, properties, sqlite_sequence, voicemail_status. Example file:
calllog.db.zip

Error:

INFO:andriller.windows:Decoding contacts2.db using GenericCallsDecoder
ERROR:andriller.driller:Decoding error for `contacts2.db`: no such table: calls
ERROR:andriller.driller:no such table: calls
Traceback (most recent call last):
  File "/home/pshem/z/source/andriller/andriller/driller.py", line 345, in DataDecoding
    deco = deco_class(self.work_dir, file_path)
  File "/home/pshem/z/source/andriller/andriller/decoders.py", line 252, in __init__
    super().__init__(work_dir, input_file, **kwargs)

  File "/home/pshem/z/source/andriller/andriller/classes.py", line 55, in __init__
    self.main()
  File "/home/pshem/z/source/andriller/andriller/decoders.py", line 266, in main
    for i in self.sql_table_as_dict(table, order_by='date'):
  File "/home/pshem/z/source/andriller/andriller/classes.py", line 173, in sql_table_as_dict
    return (self.zipper(row.keys(), row) for row in c.execute(query))
sqlite3.OperationalError: no such table: calls

Computer will detect the device but andriller will not. Most likely a user issue but ive tried all my fixes so just going to put this here.

i did every steps but then also this problem is coming

Andriller uses the output of adb shell screencap -p to obtain screenshot of the device. However, this output is unstripped by the adb_conn.py (https://github.com/den4uk/andriller/blob/3.2.2/andriller/adb_conn.py#L93) and some bytes (\n) are removed from the output. The resulting image is hence broken (https://github.com/den4uk/andriller/blob/master/andriller/screencap.py#L50). Changing return self.unstrip(run.stdout) to return run.stdout does fix this issue.

Edit:

\ns are not removed. \r\ns are actually replaced by \n.

Hi,
Andriller is pretty cool but limited on rooted-only device (for most interesting things).

I know that some expensive forensic extraction software uses ADB to install a temporary app that can grab all SMS and calls (among other things). This app is defined as the default SMS and calls app with the user allowing permissions.
After the extraction the app is uninstalled and the default apps are changed to the previous ones.

It would be very useful to have that kind of extraction.
Thanks.

i have try to run in my Windows

also im try to serach google but fail

I need help i am not a python expert but i am trying use Andriller to learning purposes,
i am with the next problem:

File "C:\TEST\lib\site-packages\andriller\driller.py", line 320, in DataExtraction
targets = self.registry.get_all_links()
TypeError: 'list' object is not callable

"English is not my main lenguage, sorry for the expressions"
thanks

dear all,
In a windows 10 evironment I am trying to update andriller. Actually I've got version 3.5.1
I tried -U option but with no result. Can someone help me?
thanks

(env) dabeersboys@COMPUTERNAME1:~$ python -m andriller
Failed to execute a gui window.
Traceback (most recent call last):
File "/home/dabeersboys/env/lib/python3.6/site-packages/andriller/init.py", line 42, in run
root = windows.MainWindow(log_level=level)
File "/home/dabeersboys/env/lib/python3.6/site-packages/andriller/windows.py", line 174, in init
super().init(**kwargs)
File "/home/dabeersboys/env/lib/python3.6/site-packages/andriller/windows.py", line 79, in init
self.root = tk.Tk()
File "/usr/lib/python3.6/tkinter/init.py", line 2023, in init
self.tk = _tkinter.create(screenName, baseName, className, interactive, wantobjects, useTk, sync, use)
_tkinter.TclError: no display name and no $DISPLAY environment variable

Hello my friends,
I'm newbie here..

I just trying to install andriller on my kali using:

Sudo pip install andriller -U

But there was having problem
Could not fetch URL https://pypi.org/simple/andriller/: there was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443)

I admit that I never seen something like that ... I have installed andriller CE on a clean XUbuntu 18.04 LTS machine without any kind of error or warning in a "venv" env like the instructions provided on the README of the project, I was been able to create a backup of an Android cell without any kind of problem, but when I try to parse the output the X11/Window Manager completely freeze.

The only solution is to CTRL+ALT+F1 moving to the shell term and issue a killall -9 python3 ...

The problem arise when I click on any "parse button" (for example the AB File...), the file selector appear and ... X11 freeze, I cannot select anything on the file selector nor in any other window that is on the screen or the system menu. The only thing that is alive is the mouse pointer ...

PS: the only difference in the install procedure is that I have installed python3-venv with apt-get because is not installed by default ...

Did you have any idea of how can solve this problem?

Regards
Danilo

Describe the bug
Cannot run brew cask on my Mac as outlined in your README

To Reproduce

1. Run brew cask install android-platform-tools

Error: brew cask is no longer a brew command. Use brew <command> --cask instead.

Environment (please complete the following information):

• OS: MacOS Monterey

When using the command "pip install andriller -U or pip install andriller or pip install andriller-3.5.3-py3-none-any.whl"
My system is throwing an errors shown below in the images.

Not sure what I am doing wrong.
python version 3.9.1
pip version: 20.2.3

Dates in the DB I have are in unix milliseconds. The parser used Google Time and reports the incorrect time.

Currently: DateTime("history"."date" / 1000000 - 11644473600, 'unixepoch') || " UTC" AS "Last Time Visited"
Should be: DateTime("history"."date" / 1000, 'unixepoch') || " UTC" AS "Last Time Visited",

-Sam

Hi,

I have an error at windows;
When I used below command Then I got error;

.\env\Scripts\activate

Error: The system cannot find the path specified.

I have Python27 and Python37

Describe the bug
When installing andriller from the pip package or the github repo, I get the following error:

AttributeError: module 'jinja2' has no attribute 'evalcontextfilter'

To Reproduce
Steps to reproduce the behavior:

1. pip install andriller
2. python -m andriller
3. See error

Environment (please complete the following information):

• OS: Debian
• Andriller version 3.6.1 (from github 50c4785 or pypi)
• Python version 3.9.12

Fix
Fix the version of jinja2 and markupsafe in requirements.txt :

markupsafe==2.0.1
Jinja2==2.11.2

Hello,

I tried running this after a successful install in my virtualenv.

This is the stack trace:

python -m andriller
INFO:andriller.windows:Started: Andriller CE 3.5.1
ERROR:andriller:Failed to execute a gui window.
Traceback (most recent call last):
  File "/Users/user/Downloads/temp/env/lib/python3.8/site-packages/andriller/__init__.py", line 42, in run
    root = windows.MainWindow(log_level=level)
  File "/Users/user/Downloads/temp/env/lib/python3.8/site-packages/andriller/windows.py", line 306, in __init__
    self.adb = adb_conn.ADBConn(logger=logger, log_level=self.log_level)
  File "/Users/user/Downloads/temp/env/lib/python3.8/site-packages/andriller/adb_conn.py", line 41, in __init__
    self.setup(log_level)
  File "/Users/user/Downloads/temp/env/lib/python3.8/site-packages/andriller/adb_conn.py", line 49, in setup
    self.adb_bin = self.cmd_shell('which adb') or None
  File "/Users/user/Downloads/temp/env/lib/python3.8/site-packages/timeout_decorator/timeout_decorator.py", line 91, in new_function
    return timeout_wrapper(*args, **kwargs)
  File "/Users/user/Downloads/temp/env/lib/python3.8/site-packages/timeout_decorator/timeout_decorator.py", line 146, in __call__
    self.__process.start()
  File "/usr/local/Cellar/[email protected]/3.8.3_2/Frameworks/Python.framework/Versions/3.8/lib/python3.8/multiprocessing/process.py", line 121, in start
    self._popen = self._Popen(self)
  File "/usr/local/Cellar/[email protected]/3.8.3_2/Frameworks/Python.framework/Versions/3.8/lib/python3.8/multiprocessing/context.py", line 224, in _Popen
    return _default_context.get_context().Process._Popen(process_obj)
  File "/usr/local/Cellar/[email protected]/3.8.3_2/Frameworks/Python.framework/Versions/3.8/lib/python3.8/multiprocessing/context.py", line 283, in _Popen
    return Popen(process_obj)
  File "/usr/local/Cellar/[email protected]/3.8.3_2/Frameworks/Python.framework/Versions/3.8/lib/python3.8/multiprocessing/popen_spawn_posix.py", line 32, in __init__
    super().__init__(process_obj)
  File "/usr/local/Cellar/[email protected]/3.8.3_2/Frameworks/Python.framework/Versions/3.8/lib/python3.8/multiprocessing/popen_fork.py", line 19, in __init__
    self._launch(process_obj)
  File "/usr/local/Cellar/[email protected]/3.8.3_2/Frameworks/Python.framework/Versions/3.8/lib/python3.8/multiprocessing/popen_spawn_posix.py", line 47, in _launch
    reduction.dump(process_obj, fp)
  File "/usr/local/Cellar/[email protected]/3.8.3_2/Frameworks/Python.framework/Versions/3.8/lib/python3.8/multiprocessing/reduction.py", line 60, in dump
    ForkingPickler(file, protocol).dump(obj)
_pickle.PicklingError: Can't pickle <function ADBConn.cmd_shell at 0x103fee940>: it's not the same object as andriller.adb_conn.ADBConn.cmd_shell

I've got android-platform-tools installed (brew cask install android-platform-tools). Running this on OSX with python 3.8.3.

Any idea how I can get this running?

I get incomplete accounts, example - "dan********gmail.com". What should I do? Help me plese

Here's a text message from the SMS Snippets (logs.db) file: Hey there? doesn't ya kitty 😻 just ❤ the way my � in hex: \x48\x65\x79 \x74\x68\x65\x72\x65\x3f \x64\x6f\x65\x73\x6e\x27\x74 \x79\x61 \x6b\x69\x74\x74\x79 \xf0\x9f\x98\xbb \x6a\x75\x73\x74 \xe2\x9d\xa4 \x74\x68\x65 \x77\x61\x79 \x6d\x79 \xed\xa0\xbd. I am getting the following error message:

Started: Andriller CE 3.4.0
Time settings/format: Y-m-d H:M:S Z
Detected/PC time: 2020-10-07 08:55:20
Universal time: 2020-10-07 12:55:20 UTC
Time in reports: 2020-10-07 12:55:20 UTC <--
Decoding: logs.db
Decoding: logs.db
Could not decode to UTF-8 column 'm_content' with text 'Hey there? doesn't ya kitty ���� just ��� the way my ���'
Traceback (most recent call last):
File "C:\Users\User1\Downloads\andriller-master\andriller-master\andriller\windows.py", line 63, in func
return method(self, *args, **kwargs)
File "C:\Users\User_1\Downloads\andriller-master\andriller-master\andriller\windows.py", line 510, in decode_file
dec = decoder.class(work_dir, file_path)
File "C:\Users\User_1\Downloads\andriller-master\andriller-master\andriller\classes.py", line 56, in init
self.main()
File "C:\Users\User_1\Downloads\andriller-master\andriller-master\andriller\decoders.py", line 272, in main
for i in self.sql_table_as_dict(table, **kw):
File "C:\Users\User_1\Downloads\andriller-master\andriller-master\andriller\classes.py", line 176, in
return (self.zipper(row.keys(), row) for row in c.execute(query))
sqlite3.OperationalError: Could not decode to UTF-8 column 'm_content' with text 'Hey there? doesn't ya kitty ���� just ��� the way my ���'
Started: Andriller CE 3.4.0
Time settings/format: Y-m-d H:M:S Z
Detected/PC time: 2020-10-07 08:55:20
Universal time: 2020-10-07 12:55:20 UTC
Time in reports: 2020-10-07 12:55:20 UTC <--
Decoding: logs.db
Decoding: logs.db
Could not decode to UTF-8 column 'm_content' with text 'Hey there? doesn't ya kitty ���� just ��� the way my ���'
Traceback (most recent call last):
File "C:\Users\User_1\Downloads\andriller-master\andriller-master\andriller\windows.py", line 63, in func
return method(self, *args, **kwargs)
File "C:\Users\User_1\Downloads\andriller-master\andriller-master\andriller\windows.py", line 510, in decode_file
dec = decoder.class(work_dir, file_path)
File "C:\Users\User_1\Downloads\andriller-master\andriller-master\andriller\classes.py", line 56, in init
self.main()
File "C:\Users\User_1\Downloads\andriller-master\andriller-master\andriller\decoders.py", line 272, in main
for i in self.sql_table_as_dict(table, **kw):
File "C:\Users\User_1\Downloads\andriller-master\andriller-master\andriller\classes.py", line 176, in
return (self.zipper(row.keys(), row) for row in c.execute(query))
sqlite3.OperationalError: Could not decode to UTF-8 column 'm_content' with text 'Hey there? doesn't ya kitty ���� just ��� the way my ���'

$ python -m andriller
Traceback (most recent call last):
File "/usr/lib/python2.7/runpy.py", line 174, in _run_module_as_main
"main", fname, loader, pkg_name)
File "/usr/lib/python2.7/runpy.py", line 72, in _run_code
exec code in run_globals
File "/home/zorman32/Downloads/andriller-master/andriller/main.py", line 4, in
run()
File "andriller/init.py", line 34, in run
from . import windows
File "andriller/windows.py", line 53
self.tk_obj.insert('end', f'{log}\n')
^
SyntaxError: invalid syntax

-noob breaking in to my own phone (suspect it's been hacked) required packages installed fine, bash command returned the error above.

Hi,

after activating the Extract-Button I have got this error message:

C:\Users\Test>.\env\Scripts\activate

(env) C:\Users\Test>python -m andriller
INFO:andriller.windows:Started: Andriller CE 3.5.1
INFO:andriller.windows:Time settings/format: Y-m-d H:M:S Z
INFO:andriller.windows:Detected/PC time: 2020-11-04 18:19:00
INFO:andriller.windows:Universal time: 2020-11-04 17:19:00 UTC
INFO:andriller.windows:Time in reports: 2020-11-04 17:19:00 UTC <--
INFO:andriller.windows:Reading information...
Exception in thread Thread-8:
Traceback (most recent call last):
File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.8_3.8.1776.0_x64__qbz5n2kfra8p0\lib\threading.py", line 932, in _bootstrap_inner
self.run()
File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.8_3.8.1776.0_x64__qbz5n2kfra8p0\lib\threading.py", line 870, in run
self._target(*self._args, **self._kwargs)
File "C:\Users\Test\env\lib\site-packages\andriller\utils.py", line 40, in command
return method(self, *args, **kwargs)
File "C:\Users\Test\env\lib\site-packages\andriller\windows.py", line 532, in RunUsbExtraction
drill.InitialAdbRead()
File "C:\Users\Test\env\lib\site-packages\andriller\driller.py", line 108, in InitialAdbRead
self.REPORT['permisson'] = get_permission()
File "C:\Users\Test\env\lib\site-packages\andriller\driller.py", line 79, in get_permission
if 'root' in self.adb('exec-out id'):
TypeError: argument of type 'NoneType' is not iterable

I tried to extract an older Fire HD Tablet with an older Version of CyanogenMod 11 installed.

Best Regards

When I install andriller with pipx
pipx install andriller
I get this error:
ModuleNotFoundError: No module named 'andriller.gui'

I got this error when it was upgraded from version 3.5.3 to 3.6.0

Any ideas ?

Got stuck with this error.

File "/home/xxxx/andriller/andriller/utils.py", line 40, in command
return method(self, *args, **kwargs)
File "/home/xxxx/andriller/andriller/gui/windows.py", line 418, in RunUsbExtraction
drill.DataExtraction()
File "/home/xxxx/andriller/andriller/driller.py", line 320, in DataExtraction
self.ExtractFromTar(targets=targets)
File "/home/xxxx/andriller/andriller/driller.py", line 257, in ExtractFromTar
for fn in self.tools.extract_form_tar(
File "/home/xxxx/andriller/andriller/utils.py", line 174, in extract_form_tar
for tar_name in tar.getnames():
File "/usr/lib/python3.10/tarfile.py", line 1995, in getnames
return [tarinfo.name for tarinfo in self.getmembers()]
File "/usr/lib/python3.10/tarfile.py", line 1987, in getmembers
self._load() # all members, we first have to
File "/usr/lib/python3.10/tarfile.py", line 2682, in _load
tarinfo = self.next()
File "/usr/lib/python3.10/tarfile.py", line 2589, in next
raise ReadError("unexpected end of data")
tarfile.ReadError: unexpected end of data

Hey, thanks for the tool.

I have a question, my cell phone is broken but can't find any db. I have also searched the root folder and the ones indicated in the program do not appear. Is there anything I need to do for it to extract all the .db?

Tested on xiaomi MIa3

(https://user-images.githubusercontent.com/19245743/83171232-6a4dff80-a0db-11ea-990e-211cc6547647.PNG)

During run on Debian based distro (Parrot) and recovering data from a Samsung S3 New, when click
on extract (via ADB)

1. without check "use AB method" and "extract shared storage" i get this
   INFO:andriller.windows:Acquiring data...
   INFO:andriller.windows:Acquiring databases via root...
   Exception in thread Thread-3:
   Traceback (most recent call last):
   File "/usr/lib/python3.8/threading.py", line 932, in _bootstrap_inner
   self.run()
   File "/usr/lib/python3.8/threading.py", line 870, in run
   self._target(*self._args, **self._kwargs)
   File "/home/simo/env/lib/python3.8/site-packages/andriller/utils.py", line 40, in command
   return method(self, *args, **kwargs)
   File "/home/simo/env/lib/python3.8/site-packages/andriller/windows.py", line 534, in RunUsbExtraction
   drill.DataAcquisition(
   File "/home/simo/env/lib/python3.8/site-packages/andriller/driller.py", line 307, in DataAcquisition
   self.download_file(file_path)
   File "/home/simo/env/lib/python3.8/site-packages/andriller/driller.py", line 202, in download_file
   remote_size = self.adb.get_size(file_path, su=self.su)
   File "/home/simo/env/lib/python3.8/site-packages/andriller/adb_conn.py", line 172, in get_size
   if not size.isdigit():
   AttributeError: 'NoneType' object has no attribute 'isdigit'

2. check both andriller not recover any files

Thanks (I hope not make a mistake)

UnicodeEncodeError: 'gbk' codec can't encode character '\ud3ed' in position 3530: illegal multibyte sequence

the problem is when i use password pin cracking or pasword cracking the error is enexpected floating point

I use it on my Kali Linux 2020.4 and when I scan some phone I got the report of calendar only.
An image of report is here https://i.imgur.com/J7QNyME.png

Hi. I can't find anything on the wiki or website so I thought this would be a good place to ask.
Andriller is hanging on the unpacking of the backup, is this due to it being password protected?
The phone in question would not start the backup process without a password.

Just ran the latest exe installer and it popped up, won't let me run it.

Hello,

in version 3.5.3 Screen Capture generates an invalid .png image.